Data Processing Agreement
This draft sets out how the service provider would process personal data on behalf of a customer who uses Nash'a. It is not complete, it has not been reviewed by a lawyer, and it is not an offer. Bracketed text marks details that have not been filled in.
Parties
| Service provider (legal name) | [legal name of the service provider: to be completed] |
|---|---|
| Registered address | [registered address: to be completed] |
| Authorised signatory | [authorised signatory: to be completed] |
| Customer | [customer legal name, address and signatory: to be completed] |
Terms
- Roles. The customer decides why and how its personal data is processed. The service provider processes that data only to provide the service to the customer and only on the customer's written instructions.
- Confidentiality. The service provider keeps the customer's personal data confidential and limits access to people who need it to provide the service.
- Sub-processors. The service provider uses the sub-processors it has identified, listed by category in Annex 1. The named list is provided to the customer with the signed agreement. It will tell the customer before it adds or replaces one. The list is not a promise that no other party can ever receive data.
- Security. The service provider applies the measures described on its Trust page at /trust. That page also lists, as gaps, the measures that are not yet in place, including confirmation of encryption at rest and an audit log of operator access.
- Retention and deletion. At present there is no in-app route to export, correct or delete data, and support tickets are kept with no deletion path. Requests are handled by contacting the service provider at the address above. Any commitment to a deletion period is to be agreed and completed before signing.
- Help with requests. The service provider will pass on to the customer, without undue delay, a request it receives from a person about that customer's data.
- Incidents. The service provider will tell the customer without undue delay after it becomes aware of a personal data breach affecting the customer's data. The notification period is to be agreed and completed before signing.
- Use of data. The service provider does not currently use the customer's prompts, uploads or feedback to train a model.
- Audit. Audit and inspection terms are to be agreed and completed before signing.
- Governing law. This agreement is governed by: [governing law and jurisdiction: to be completed]
Annex 1: Sub-processors
These are the sub-processors we have identified as of [date to be set when the owner verifies], listed by category only. The named list is provided to customers with the signed Data Processing Agreement, and customers are told before a new one is added.
| Category | Purpose | Data | Region |
|---|---|---|---|
| Cloud hosting | Hosting of the application service | All data the service handles, including accounts, questions, uploads and support tickets | The application service runs in a Doha region; other services not confirmed |
| Web search | Web search, used only when a question goes to web search and a search key is configured on the deployment | The text of the question sent to web search | Not confirmed |
| Public data services | Weather, prices, news, sport and route information, used only on the realtime route | Text derived from the question | Not confirmed |
| Font delivery | Delivery of web fonts to the application's pages | Visitor IP address and user agent | Not confirmed |
| Integrations the customer switches on | Email, SMS, webhook and Slack notifications, off by default and sent to destinations the customer configures | The notification content the customer chooses to send | Set by the customer's choice of destination |
Signatures
| For the service provider | For the customer |
|---|---|
| Name: [authorised signatory: to be completed] Signature: ____________________ Date: ____________________ |
Name: ____________________ Signature: ____________________ Date: ____________________ |